WO2021244509A1

WO2021244509A1 - Data transmission method and system, electronic device, and computer readable storage medium

Info

Publication number: WO2021244509A1
Application number: PCT/CN2021/097605
Authority: WO
Inventors: 毛玉欣; 吴强; 闫新成
Original assignee: 中兴通讯股份有限公司
Priority date: 2020-06-03
Filing date: 2021-06-01
Publication date: 2021-12-09
Also published as: EP4161117A4; JP2023529181A; JP7461515B2; EP4161117A1; US20230232219A1; CN112788594A; CN112788594B; KR20230019934A

Abstract

The present invention relates to the technical field of communication security, and provides a data transmission method, which is applied in a control plane function entity, and comprises: determining target user plane data which needs to be performed security protection between a target user equipment and a user plane function entity; and sending a notification message to an access network function entity and the target user equipment, the notification message being used for instructing to perform security protection on the target user plane data between the target user equipment and the user plane function entity. The present invention also provides a data transmission system, an electronic device, and a computer readable storage medium.

Description

Data transmission method and system, electronic equipment and computer readable storage medium

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office with an application number of 202010497744.4 on June 3, 2020, and the entire content of the application is incorporated into this application by reference.

Technical field

The embodiments of the present disclosure relate to the technical field of communication security.

Background technique

Related technologies protect user plane data transmission between user equipment (UE, User Equipment) and access network (RAN, Radio Access Network) functional entities with confidentiality (Ciphering) and/or integrity (Integrity).

Summary of the invention

One aspect of the embodiments of the present disclosure provides a data transmission method, which is applied to a control plane functional entity, including: determining a target user plane that needs to be secured between a target user equipment and a user plane function (User Plane Function, UPF) entity Data; and, sending a notification message to the access network functional entity and the target user equipment; where the notification message is used to indicate that the target user plane data is securely protected between the target user equipment and the user plane functional entity.

Another aspect of the embodiments of the present disclosure provides a data transmission method, which is applied to an access network function entity, and includes: receiving a notification message sent by a control plane function entity; wherein the notification message is used to indicate that the target user equipment and the user plane function Security protection of target user plane data between entities.

Another aspect of the embodiments of the present disclosure provides a data transmission method, which is applied to a user plane functional entity, including: receiving a first key sent by a control plane functional entity, or receiving a second key sent by a control plane functional entity and according to The second key generates the first key; and the first key is used to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity.

Another aspect of the embodiments of the present disclosure provides a data transmission method, which is applied to a target user equipment, and includes: receiving a notification message sent by a control plane functional entity; wherein the notification message is used to indicate that the target user equipment and the user plane functional entity are Safely protect the target user plane data in time.

Another aspect of the embodiments of the present disclosure provides an electronic device, including: at least one processor; and, a memory on which at least one program is stored. When the at least one program is executed by the at least one processor, the at least one processor realizes At least one step of any of the above data transmission methods.

Another aspect of the embodiments of the present disclosure provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, at least one step of any of the foregoing data transmission methods is realized.

Another aspect of the embodiments of the present disclosure provides a data transmission system, including: a control plane functional entity configured to determine target user plane data that needs to be secured between the target user equipment and the user plane functional entity, and a connection The network access functional entity and the target user equipment send a notification message, where the notification message is used to instruct the target user plane data to be securely protected between the target user equipment and the user plane functional entity; the access network functional entity is configured to receive the control plane The notification message sent by the functional entity; and the target user equipment is configured to receive the notification message sent by the control plane functional entity.

Description of the drawings

Figure 1 is a kind of security protection mechanism in the process of data transmission in the fifth generation mobile communication technology (5th Generation Mobile Communication Technology, 5G) defined by the 3rd Generation Partnership Project (3GPP, The 3rd Generation Partnership Project) R15 in related technologies Schematic.

Fig. 2 is a flowchart of a data transmission method provided by an embodiment of the disclosure.

FIG. 3 is a flowchart of a data transmission method provided by an embodiment of the disclosure.

FIG. 4 is a flowchart of a data transmission method provided by an embodiment of the disclosure.

FIG. 5 is a flowchart of a data transmission method provided by an embodiment of the disclosure.

FIG. 6 is a flowchart of a data transmission method provided by an embodiment of the disclosure.

FIG. 7 is a flowchart of a data transmission method provided by an embodiment of the disclosure.

FIG. 8 is a schematic diagram of a protocol stack structure provided by an embodiment of the disclosure.

FIG. 9 is a schematic diagram of a protocol stack structure provided by an embodiment of the disclosure.

FIG. 10 is a block diagram of a composition of a data transmission device provided by an embodiment of the disclosure.

FIG. 11 is a block diagram of a composition of a data transmission device provided by an embodiment of the disclosure.

FIG. 12 is a block diagram of a composition of a data transmission device provided by an embodiment of the disclosure.

FIG. 13 is a block diagram of a composition of a data transmission device provided by an embodiment of the disclosure.

FIG. 14 is a block diagram of a composition of a data transmission system provided by an embodiment of the disclosure.

detailed description

In order to enable those skilled in the art to better understand the technical solutions of the present disclosure, the data transmission method, device and system, electronic equipment, and computer-readable storage medium provided by the present disclosure will be described in detail below with reference to the accompanying drawings.

Hereinafter, example embodiments will be described more fully with reference to the accompanying drawings, but example embodiments may be embodied in different forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, the purpose of providing the embodiments is to make the present disclosure thorough and complete, and to enable those skilled in the art to fully understand the scope of the present disclosure.

In the case of no conflict, the embodiments of the present disclosure and the features of the embodiments can be combined with each other.

As used herein, the term "and/or" includes any and all combinations of at least one related listed item.

The terms used herein are only used to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a" and "the" are also intended to include the plural forms, unless the context clearly dictates otherwise. It will also be understood that when the terms "including" and/or "made from" are used in this specification, it specifies the presence of features, wholes, steps, operations, elements and/or components, but does not exclude the presence or addition of at least One other feature, whole, step, operation, element, component and/or group thereof.

Unless otherwise defined, the meanings of all terms (including technical and scientific terms) used herein are the same as those commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having meanings consistent with their meanings in the context of the related technology and the present disclosure, and will not be interpreted as having idealized or excessive formal meanings, Unless this article specifically defines it as such.

Related communication networks are subject to deep binding of software and hardware, with single network performance, poor networking flexibility, and limited expansion. It is difficult to build a network to simultaneously adapt to the differentiated requirements of different applications for network service performance such as bandwidth, delay, and reliability. 5G has carried out a deep reconstruction of the network architecture. Based on virtualization and software-defined technology, a service-oriented architecture is introduced. On a shared and unified hardware platform, virtualized network functions are built on demand according to application requirements, and network slicing is built to provide better Network service performance that meets application requirements. For example, for IoT applications with fixed terminal locations, there is no need to introduce mobility management functions when constructing network slices that provide network services for them; for low-latency applications, user plane functions need to be lowered to the edge of the network when constructing network slices Deployment to shorten the data transmission delay to meet the application's requirements for network delay. In other words, 5G can provide network services with different characteristics for different applications with the help of emerging technologies such as virtualization and network slicing.

When 5G networks provide network services for applications in various industries, they carry various high-value application data and sensitive data such as privacy. Attacks on networks to obtain or tamper with data have never stopped, and as the future 5G network bears business data continuously enriched, attack methods are still evolving. Therefore, protection measures such as the integrity and confidentiality protection of data during network transmission are indispensable.

Confidentiality refers to the encrypted transmission of data to prevent the data from being eavesdropped and illegally obtained during the transmission; integrity refers to the integrity of the transmitted data at the sending end and the integrity verification at the receiving end, thereby preventing the transmission process The data in it has been tampered with.

The data transmitted by the 5G network is divided into two categories: one is control plane signaling data, such as the signaling of the user to register to the network, and the signaling of the slice session of the access network functional entity; the other is the user conducting business. Face data, such as online video service data.

Figure 1 is a schematic diagram of the security protection mechanism in the process of data transmission in the 5G network defined by 3GPP R15. As shown in Figure 1, A in Figure 1 represents the confidentiality and/or integrity protection of the control plane data between the user equipment and the access network functional entity, and B in Figure 1 represents the relationship between the UE and the RAN functional entity. Confidentiality and/or integrity protection of user plane data between UEs; C in Figure 1 represents confidentiality and/or integrity protection of control plane data between the UE and the 5G core network (5GC, 5G Core network), However, confidentiality and/or integrity protection of the user plane data transmission between the UE and the 5GC has not yet been required. The user plane data is transmitted in plain text between the RAN and the 5GC, as shown in D in Figure 1.

When 5G provides network services for vertical industries, based on the business characteristics of the vertical industries, the user plane data needs to be provided with UE to 5GC transmission path for security protection requirements, mainly based on the following reasons (1)-(3).

(1) The configuration of the access network functional entity is easier to expose, and the configuration of the access network functional entity side encryption, authentication, and user plane integrity protection is more vulnerable to attack.

(2) Compared with the functional entity side of the access network, the network nodes on the core network side have stronger computing capabilities, which helps to reduce the delay of data interaction, and vertical industries often attach great importance to low-latency experience.

(3) Network slicing operators (operators that provide network services for vertical industry applications) may lease RAN resources from other operators. From the perspective of network slicing operators or industry applications, the access network functional entity is not a device that is absolutely trusted. Therefore, network slicing operators or industry applications hope that data transmission is safely terminated on the core network rather than the access network functional entity of the access network. side.

In response to the above security requirements, part of the security protection requirements can be achieved through the following methods: Refer to the method shown in Figure 1 for the protection between the UE and the access network functional entity, and the boundary network element of the access network and the core network boundary network Between the elements, that is, D in Figure 1 establishes an encrypted channel, such as Internet Protocol Security (IPSec), to encrypt and/or all data transmitted between the boundary network elements of the access network and the boundary network elements of the core network Integrity protection. Although this method realizes the security protection of user plane data between the UE and the 5GC, it has the following shortcomings 1)-3).

1) Encryption and/or integrity protection shall be implemented for all data transmitted between the boundary network elements of the access network and the boundary network elements of the core network. Encryption protection shall be implemented for data regardless of whether there is an encryption requirement, which will reduce processing efficiency. Increase business delay.

2) The access network functional entity still participates in the process of data encryption and decryption and/or integrity verification, and there is still the risk that the access network functional entity is untrusted and the access network functional entity is attacked, resulting in data security.

3) The application itself provides protection mechanisms such as application layer encryption to ensure the security of user plane data. For example, some applications use Secure Sockets Layer (SSL) to encrypt and transmit application data. However, not every application has the functions of encrypting, protecting and verifying user plane data at the application layer. The above-mentioned solutions are specific to various applications and are not easy to promote.

Currently, only the confidentiality and/or integrity protection of the user plane data transmission between the user equipment and the access network functional entity is carried out, but the confidentiality and/or integrity of the user plane data transmission between the RAN and the core network is not carried out. Protect. In some scenarios, confidentiality and/or integrity protection of the user plane data transmission between the user equipment and the core network is required, and the foregoing protection methods cannot meet the protection requirements of these scenarios.

The embodiments of the present disclosure provide a data transmission method, which can be applied to control plane functional entities. 2, which is a flowchart of a data transmission method provided by an embodiment of the present disclosure. The method includes step 200 and step 201.

In step 200, the target user plane data that needs to be securely protected between the target user equipment and the user plane functional entity is determined.

In an implementation manner, it is possible to determine which user plane data needs to be secured between the target user equipment and the user plane functional entity according to the user subscription information. Of course, there are many other ways, and the specific determination strategy is not used to limit the protection scope of the embodiments of the present disclosure, and will not be repeated here.

In an implementable manner, the target user plane data that needs to be securely protected between the target user equipment and the user plane functional entity may be determined during the registration process of the target UE to the core network. For example, after the authentication process is completed, determine the target user plane data that needs to be secured between the target user equipment and the user plane functional entity. In this case, the target user plane data is all user plane data of the target UE.

In another implementable manner, the target user plane data that needs to be secured between the target user equipment and the user plane functional entity may be determined during the establishment of a protocol data unit (Protocol Data Unit, PDU) session. For example, after receiving a PDU session context creation response from a Session Management Function (SMF) entity, determine the target user plane data that needs to be secured between the target user equipment and the user plane function entity. In this case, the target user plane data is the user plane data corresponding to the PDU session.

In step 201, a notification message is sent to the access network functional entity and the target UE, and the notification message is used to indicate that the target user plane data is securely protected between the target user equipment and the user plane functional entity.

In an implementable manner, a notification message may be sent to the access network functional entity and the target UE during the registration process of the UE to the core network. For example, after the authentication process is completed, a notification message is sent to the access network functional entity and the target UE. After receiving the notification message, the UE confirms that the target user plane data needs to be securely protected between the UE and the user plane function entity; after receiving the notification message, the access network function entity confirms that the UE and the user who need to register with the core network The security protection of target user plane data is carried out between the plane functional entities. In this case, the notification message is used to instruct the security protection of all user plane data of the UE between the target user equipment and the user plane functional entity.

In another implementable manner, a notification message may be sent to the access network functional entity and the UE during the establishment of the PDU session. For example, after receiving the PDU session context creation response from the SMF entity, a notification message is sent to the access network function entity and the UE. In this case, the notification message is used to instruct the user plane data corresponding to the PDU session of the UE to be secured between the user equipment and the user plane functional entity.

That is, for some UEs, after it is determined that all user plane data needs to be secured between the target user equipment and the user plane functional entity, a notification message is sent to the access network functional entity and the user equipment; for some UEs After determining that all user plane data of the target UE does not require security protection between the target UE and the user plane functional entity, no notification message is sent to the access network functional entity and the UE. In this way, the user plane data of all UEs is not secured between the UE and the user plane functional entity, but the user plane data of some UEs is secured between the UE and the user plane functional entity. The security protection of the user plane data of the UE between the UE and the user plane functional entity can be determined according to the subscription data of the UE, and the user can sign a contract with the operator according to their own needs.

Or, for some PDU sessions of a certain UE, after it is determined that the user plane data corresponding to the PDU session needs to be secured between the user equipment and the user plane functional entity, a notification is sent to the access network functional entity and the user equipment Message; for other PDU sessions of the UE, after determining that the user plane data corresponding to the PDU session does not need to be secured between the UE and the user plane function entity, no notification message is sent to the access network function entity and the UE . In this way, the user plane data corresponding to all PDU sessions of the UE is not securely protected between the UE and the user plane functional entity, but the user plane data corresponding to part of the PDU session of the UE is between the UE and the user plane functional entity. Security protection is performed between the UE and the user plane data corresponding to which PDU sessions of the UE. The security protection between the UE and the user plane functional entity can be determined according to the subscription data of the UE. The user can sign a contract with the operator according to their own needs. accomplish.

In an implementable manner, the method may further include: obtaining the first key, and sending the first key to the user plane function entity. The first key is used by the user plane functional entity and the target user equipment to securely protect the target user plane data between the target user equipment and the user plane functional entity.

In an implementation manner, the first key is a key used to securely protect the target user plane data between the target user equipment and the user plane functional entity.

In an implementable manner, the first key may directly adopt a key for security protection of the target user plane data between the target UE and the RAN functional entity. In another implementable manner, the first key may also directly adopt a key for security protection of the control plane data between the target UE and the RAN functional entity.

In one possible implementation, the first key may include an encryption key. In another possible implementation, the first key may include an integrity key. In another possible implementation, the first key may include an encryption key and an integrity key.

In an implementable manner, the encryption key is used to protect the confidentiality of the target user plane data between the UE and the user plane functional entity, and the integrity key is used to protect the target user between the UE and the user plane functional entity. Integrity protection of surface data.

In an implementation manner, the first key is the first key corresponding to the target UE, and the first keys corresponding to different target UEs may be the same or different.

In another implementable manner, the first key is the first key corresponding to the PDU session of the target UE. Specifically, one PDU session may correspond to one first key, or two or more PDU sessions may correspond to one first key. The first key.

In an implementable manner, the first key may be obtained in any of the following manners: in manner one; the first key returned by the access network functional entity is received; in manner two, the target user equipment is received The first key returned.

In an implementation manner, in order to improve the security during the transmission of the first key, the first key returned by the target user equipment may be received through a non-access stratum (Non-Access Stratum, NAS) secure channel.

In an implementable manner, the method may further include: generating a second key, and sending the second key to the user plane function entity. The second key is used by the user plane function entity to generate the first key.

In an implementation manner, the second key is used to generate the first key, and the first key is a key for security protection of the target user plane data between the user equipment and the user plane functional entity.

In an implementation manner, the second key is used for key isolation to prevent the leakage of one key and affect the security of other keys, thereby improving security.

In an implementation manner, the anchor key may be generated first, and then the second key may be generated according to the anchor key.

According to the data transmission method provided by the embodiments of the present disclosure, the control plane function entity determines the target user plane data that needs to be secured between the target user equipment and the user plane function entity, and then notifies the access network function entity and the target user equipment, The target user equipment and the user plane functional entity are enabled to perform security protection on the target user plane data, and the security protection of the target user plane data between the target user equipment and the user plane functional entity is realized.

The embodiment of the present disclosure also provides another data transmission method, which can be applied to the access network functional entity. 3, which is a flowchart of a data transmission method provided by an embodiment of the present disclosure. The method may include step 300.

In step 300, a notification message sent by a control plane functional entity is received, where the notification message is used to instruct the target user plane data to be securely protected between the target user equipment and the user plane functional entity.

In an implementable manner, the notification message sent by the control plane function entity may be received during the registration process of the target UE to the core network. For example, after the authentication process is completed, a notification message sent by the control plane functional entity is received. In this case, the notification message is used to instruct the security protection of all user plane data of the target UE between the target user equipment and the user plane functional entity.

In another implementation manner, the notification message sent by the control plane function entity may be received during the establishment of the PDU session. For example, after the N4 session is established between the SMF entity and the UPF entity, a notification message sent by the control plane function entity is received. In this case, the notification message is used to instruct the user plane data corresponding to the PDU session of the target UE to be secured between the target user equipment and the user plane functional entity.

It should be noted that for some UEs, if the UE receives a notification message sent by the control function entity during the registration process of the UE to the core network, it means that all users of the UE need to be notified between the UE and the user plane function entity. The security protection of the plane data; for some UEs, if the UE does not receive the notification message sent by the control plane function entity during the registration process of the UE to the core network, it means that there is no need to communicate between the UE and the user plane function entity. All user plane data of the UE is secured. In this way, the user plane data of all UEs is not secured between the UE and the user plane functional entity, but the user plane data of some UEs is secured between the UE and the user plane functional entity. The security protection of the user plane data of the UE between the UE and the user plane functional entity can be determined according to the subscription data of the UE, and the user can sign a contract with the operator according to their own needs.

For some PDU sessions of the target UE, if a notification message sent by the surface control function entity is received during the establishment of the PDU session, it indicates that the user plane data corresponding to the PDU session needs to be performed between the target UE and the user plane function entity. Security protection; for some PDU sessions, if the notification message sent by the control plane function entity is not received during the establishment of the PDU session, it means that there is no need for the user plane corresponding to the PDU session between the target UE and the user plane function entity. Data is secured. In this way, the user plane data corresponding to all PDU sessions of the UE is not securely protected between the UE and the user plane functional entity, but the user plane data corresponding to part of the PDU session of the UE is between the UE and the user plane functional entity. Security protection is performed between the UE and the user plane data corresponding to which PDU sessions of the UE. The security protection between the UE and the user plane functional entity can be determined according to the subscription data of the UE. The user can sign a contract with the operator according to their own needs. accomplish.

In an implementation manner, after receiving the notification message sent by the control plane functional entity, the method may further include: sending the first key to the control plane functional entity. The first key is used by the user plane functional entity and the target user equipment to securely protect the target user plane data between the target user equipment and the user plane functional entity.

In one possible implementation, the first key may include an encryption key. In another possible implementation, the first key includes an integrity key. In another possible implementation, the first key may include an encryption key and an integrity key.

In an implementable manner, the encryption key is used to protect the confidentiality of target user plane data between the target UE and the user plane functional entity, and the integrity key is used to protect the target user between the target UE and the user plane functional entity. Integrity protection of surface data.

In an implementation manner, after receiving the notification message sent by the control plane functional entity, the method may further include: determining, according to the notification message, whether the user plane data received by the access network functional entity is target user plane data; User plane data is not processed for security protection, and is forwarded after protocol conversion.

Specifically, protocol conversion is performed on the received uplink target user plane data of the target UE, and the uplink target user plane data after the protocol conversion is sent to the user plane functional entity; the received downlink target user plane data of the target UE is performed The protocol conversion is to send the downlink target user plane data after the protocol conversion to the target user equipment.

In another implementable manner, after determining that the user plane data received by the access network functional entity is not the target user plane data, the method may further include: processing the user plane data according to related technologies. For example, if the received user plane data is user plane data that is securely protected between the target UE and the RAN functional entity, then the received user plane data is processed for security protection; such as the received UE uplink user plane data Perform integrity verification, decrypt after the verification is passed, and perform protocol conversion on the decrypted uplink user plane data. If the received user plane data is not the user plane data for security protection between the target UE and the RAN functional entity, the received user plane data will not be processed for security protection, and the protocol will be converted before forwarding; such as the uplink to the target UE User plane data is forwarded after protocol conversion.

According to the data transmission method provided by the embodiments of the present disclosure, the control plane function entity determines the target user plane data that needs to be secured between the target user equipment and the user plane function entity, and then notifies the access network function entity and the target user equipment, Make the target user equipment and the user plane functional entity secure the target user plane data, and realize the security protection of the target user plane data between the target user equipment and the user plane functional entity; and the RAN functional entity does not participate in the target UE For the security protection of target user plane data with the user plane functional entity, the RAN functional entity transparently transmits the target user plane data transmitted between the target UE and the user plane functional entity, which is suitable for RAN untrusted and vulnerable scenarios.

The embodiments of the present disclosure also provide another data transmission method, which can be applied to user plane functional entities. 4, which is a flowchart of a data transmission method provided by an embodiment of the present disclosure. The method may include step 400 and step 401.

In step 400, the first key is obtained.

In an implementation manner, the first key corresponding to the user equipment may be obtained in any of the following manners: in the first mode, the first key corresponding to the user equipment sent by the control plane functional entity is received; in the second mode , Receiving the second key corresponding to the user equipment sent by the control plane functional entity, and generating the first key according to the second key.

Of course, the first key can also be obtained in other ways. The specific method of obtaining is not used to limit the scope of protection of the embodiments of the present disclosure. The embodiments of the present disclosure emphasize that the first key belongs to the target user equipment and the user plane function. The key used between entities to securely protect the target user plane data, as well as the key between the target user equipment and the access network functional entity. The RAN functional entity is not involved in the target user interaction between the target UE and the user plane functional entity. The security protection of the face data.

In an implementable manner, the first key may directly adopt a key for security protection of the target user plane data between the target UE and the RAN functional entity. In another implementable manner, the first key may also directly adopt a key for security protection of the control plane data between the target UE and the RAN functional entity. This solution uses the security protection key between the target UE and the access network functional entity network to implement, which simplifies the process of obtaining the security protection key.

It should be noted that for some UEs, if the first key corresponding to the UE is obtained, it means that all user plane data of the UE needs to be secured between the UE and the user plane function entity; for some UEs, if Failure to obtain the first key corresponding to the UE indicates that it is not necessary to perform security protection for all user plane data of the UE between the UE and the user plane functional entity. In this way, the user plane data of all UEs is not secured between the UE and the user plane functional entity, but the user plane data of some UEs is secured between the UE and the user plane functional entity. The security protection of the user plane data of the UE between the UE and the user plane functional entity can be determined according to the subscription data of the UE, and the user can sign a contract with the operator according to their own needs.

Or, for some PDU sessions of a certain UE, if the first key corresponding to the PDU session is obtained, it means that the user plane data corresponding to the PDU session needs to be secured between the UE and the user plane functional entity; For other PDU sessions of the UE, if the first key corresponding to the PDU session is not obtained, it means that there is no need to perform security protection for the user plane data corresponding to the PDU session between the UE and the user plane functional entity. In this way, the user plane data corresponding to all PDU sessions of the UE is not securely protected between the UE and the user plane functional entity, but the user plane data corresponding to part of the PDU session of the UE is between the UE and the user plane functional entity. Security protection is performed between the UE and the user plane data corresponding to which PDU sessions of the UE. The security protection between the UE and the user plane functional entity can be determined according to the subscription data of the UE. The user can sign a contract with the operator according to their own needs. accomplish.

In step 401, the target user plane data transmitted between the target user equipment and the user plane function entity is securely protected by the first key.

In an implementable manner, using the first key to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity may include: using a confidentiality key to pair the target user equipment sent to the target user equipment The user plane data is encrypted; the confidentiality key is used to decrypt the target user plane data received from the target user device.

In another implementable manner, using the first key to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity may include: using an integrity key to pair data sent to the target user equipment The target user plane data is integrity protected; the integrity key is used to perform integrity verification on the target user plane data received from the target user device.

In another implementable manner, using the first key to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity may include: using a confidentiality key pair to send to the target user equipment The target user plane data is encrypted, and the integrity key is used to protect the integrity of the target user plane data.

In another implementable manner, using the first key to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity may include: using an integrity key to pair data received from the target user equipment The integrity check of the target user plane data is performed, and the confidentiality key is used to decrypt the target user plane data after the verification is passed.

In an implementation manner, using the first key to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity may include: grouping the downlink target user plane data sent to the target user equipment Before Data Convergence Protocol (Packet Data Convergence Protocol, PDCP) encapsulation, use the first key to perform the first security protection process on the downlink target user plane data, and send the downlink target user plane data after the first security protection process to the access network Functional entity.

After PDCP encapsulation is performed on the received uplink target user plane data after the first security protection process from the user equipment, the first key is used to perform the second security protection process on the uplink target user plane data after the first security protection process.

The security protection scheme is implemented through the PDCP layer, rather than through the application layer, making the security protection scheme easier to promote.

In an implementable manner, the first key is the first key corresponding to the target UE, and the downlink target user plane data sent to the target UE is all downlink user plane data sent by the core network to the target UE, and the received data is from The uplink target user plane data processed by the first security protection of the target UE is all the uplink user plane data from the target UE received by the user plane functional entity.

That is, the first key is used to perform the first security protection process on all the downlink user plane data sent by the user plane function entity to the target UE, and the first key is used to perform the first security protection on all the user plane data received from the target UE. 2. Security protection processing.

In another implementable manner, the first key is the first key corresponding to the PDU session of the target UE. Specifically, one PDU session may correspond to one first key, or two or more PDU sessions may correspond to one first key. The first key, then, the downlink target user plane data sent to the target UE is the downlink user plane data sent by the core network to the target UE through the PDU session, and the uplink target user received from the target UE after the first security protection process The plane data is the uplink user plane data from the UE received by the user plane function entity through the PDU session.

That is to say, the first key is used to perform the first security protection process on the downlink user plane data sent by the user plane function entity to the target UE through the PDU session corresponding to the first key, and the user plane function entity is not connected with the first secret. The downlink user plane data sent to the UE by the PDU session corresponding to the key (that is, the PDU session other than the PDU session corresponding to the first key) does not require the first security protection processing, but is processed in accordance with related technologies; the same; Ground, the first key is used to perform the second security protection process on the uplink user plane data from the target UE received through the PDU session corresponding to the first key. For the PDU session that does not correspond to the first key (that is, The uplink user plane data received from the target UE other than the PDU session corresponding to the first key) does not need to undergo the second security protection process, but is processed in accordance with related technologies.

In the above exemplary embodiment, only the user plane data transmitted with the UE through a partial PDU session is secured, instead of all the user plane data of the UE is secured, thereby improving the user plane data that does not need to be secured. Improve processing efficiency and reduce business delay.

In an implementable manner, the security protection can be any one of the following three situations: confidentiality protection, integrity protection, or confidentiality protection and integrity protection. The three situations are described below respectively.

(1) In the case that the security protection only includes confidentiality protection, the first key only includes the encryption key. Correspondingly, using the first key to perform the first security protection processing on the downlink target user plane data includes: using an encryption key to encrypt the downlink target user plane data. Using the first key to perform the second security protection process on the uplink target user data after the first security protection process includes: using an encryption key to decrypt the encrypted uplink target user data.

(2) In the case that the security protection only includes integrity protection, the first key only includes the integrity key. Correspondingly, using the first key to perform the first security protection processing on the downlink target user plane data includes: using the integrity key to perform the integrity protection processing on the downlink target user plane data. Using the first key to perform the second security protection process on the uplink target user plane data after the first security protection process includes: using the integrity key to perform integrity verification on the uplink target user plane data after the integrity protection process.

(3) In the case that security protection includes both confidentiality protection and integrity protection, the first key includes an encryption key and an integrity key. Correspondingly, using the first key to perform the first security protection processing on the downlink target user plane data includes: using the encryption key to encrypt the downlink target user plane data, and using the integrity key to perform the encrypted downlink target user plane data. Integrity protection processing. Using the first key to perform the second security protection process on the uplink user plane data after the first security protection process includes: using the integrity key to perform integrity verification on the uplink target user plane data after the encryption and integrity protection process. After the verification is passed, the encryption key is used to decrypt the encrypted uplink target user data.

The embodiment of the present disclosure also provides another data transmission method, which can be applied to the target UE. Referring to FIG. 5, which is a flowchart of a data transmission method provided by an embodiment of the present disclosure, the method may include step 500.

In step 500, a notification message sent by a control plane functional entity is received, where the notification message is used to instruct the target user plane data to be securely protected between the target user equipment and the user plane functional entity.

It should be noted that for some UEs, if the UE receives a notification message from the control plane functional entity during the registration process of the UE with the core network, it means that all users of the UE need to be targeted between the UE and the user plane functional entity. The plane data is secured; for some UEs, if the UE does not receive a notification message from the control plane function entity during the registration process of the UE to the core network, it means that there is no need to target the UE between the UE and the user plane function entity. All user plane data of the company is secured. In this way, the user plane data of all UEs is not secured between the UE and the user plane functional entity, but the user plane data of some UEs is secured between the UE and the user plane functional entity. The security protection of the user plane data of the UE between the UE and the user plane functional entity can be determined according to the subscription data of the UE, and the user can sign a contract with the operator according to their own needs.

Or, for some PDU sessions of a certain UE, if a notification message from the control plane function entity is received during the establishment of the PDU session, it indicates that the UE and the user plane function entity need to correspond to the PDU session of the UE. The user plane data is secured; for other PDU sessions of the UE, if the notification message from the control plane function entity is not received during the establishment of the PDU session, it means that there is no need to communicate between the UE and the user plane function entity. The user plane data corresponding to the UE's PDU session is secured. This realizes that not the user plane data corresponding to all PDU sessions of the UE is securely protected between the UE and the core network, but the user plane data corresponding to some PDU sessions of the UE is securely protected between the UE and the core network. The specific security protection of which user plane data corresponding to the PDU session of the UE is performed between the UE and the core network can be determined according to the subscription data of the UE, and the user can contract with the operator according to their own needs.

In an implementation manner, after receiving the notification message, the method may further include: generating a first key, and sending the first key to the control panel functional entity. The first key includes a confidentiality key and/or an integrity key.

In an implementable manner, the first key may directly adopt a key for security protection of target user plane data between the target UE and the RAN functional entity. In another implementable manner, the first key may also directly adopt a key for security protection of control plane data between the target UE and the RAN functional entity. This solution is implemented by adopting the security protection key between the target UE and the access network functional entity network, which simplifies the process of obtaining the security protection key.

In one possible implementation, the first key may include an encryption key. In another possible implementation, the first key may include an integrity key. In another possible implementation, the first key may include an encryption key and an integrity key. In an implementable manner, the encryption key is used to protect the confidentiality of target user plane data between the target UE and the user plane functional entity, and the integrity key is used to protect the target user between the target UE and the user plane functional entity. Integrity protection of surface data.

In an implementation manner, the first key is sent to the control plane functional entity through the NAS secure channel. This technical solution improves the security during the transmission of the first key.

In another possible implementation manner, there is no need to send the first key to the control plane function entity, the network control plane function sends the second key to the user plane function entity, and the user plane function entity generates the second key according to the second key. The first key. The second key is used for key isolation, preventing one key from being leaked and affecting the security of other keys, improving security.

In an implementable manner, the method may further include: using the first key to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity.

In an implementable manner, using the first key to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity may include: using a confidentiality key to pair the target sent to the user plane functional entity The user plane data is encrypted; the confidentiality key is used to decrypt the target user plane data received from the user functional entity.

In another possible implementation manner, using the first key to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity may include: using an integrity key to pair data sent to the user plane functional entity The target user plane data is integrity protected; the integrity key is used to perform integrity verification on the target user plane data received from the user functional entity.

In another implementable manner, using the first key to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity may include: using a confidentiality key to pair data sent to the user plane functional entity The target user plane data is encrypted, and the encrypted target user plane data is integrity protected using the integrity key.

In another implementable manner, using the first key to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity may include: using an integrity key to protect the target user plane data received from the user functional entity The user plane data is checked for integrity, and after the verification is passed, the confidentiality key is used to decrypt the target user plane data.

In an implementation manner, using the first key to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity may include: performing uplink target user plane data sent to the user plane functional entity. Before PDCP encapsulation, the first key is used to perform the first security protection process on the uplink target user plane data, and the uplink target user plane data after the first security protection process is sent to the access network functional entity.

After performing PDCP decapsulation on the received downlink target user plane data after the first security protection process from the core network, use the first key to perform the second security protection process on the downlink target user plane data after the first security protection process .

In an implementable manner, the first key is the first key corresponding to the UE, and the uplink target user plane data sent to the user plane function entity is all the uplink user plane data sent by the UE to the user plane function entity. The downlink target user plane data processed by the first security protection from the core network is all downlink user plane data from the user plane functional entity received by the UE.

That is, the first key is used to perform the first security protection process on all the uplink user plane data sent by the UE to the user plane functional entity, and the first key is used to perform the first security protection processing on all the received downlink user plane data from the user plane functional entity. Perform the second security protection process.

In another implementation manner, the first key is the first key corresponding to the PDU session of the UE. Specifically, one PDU session may correspond to one first key, or two or more PDU sessions may correspond to one first key. A key, then, the uplink target user plane data sent to the user plane functional entity is the uplink user plane data sent by the UE to the user plane functional entity through the PDU session, and the received first security protection from the user plane functional entity is processed The downlink target user plane data of is the downlink user plane data from the core network received by the UE through the PDU session.

That is to say, the first key is used to perform the first security protection process on the uplink user plane data sent by the UE to the user plane function entity through the PDU session corresponding to the first key, and the PDU that does not correspond to the first key is used for the UE. The uplink user plane data sent by the session (that is, the PDU session other than the PDU session corresponding to the first key) to the user plane function entity does not need to undergo the first security protection processing, but is processed in accordance with related technologies; similarly , Use the first key to perform the second security protection process on the downlink user plane data from the user plane function entity received through the PDU session corresponding to the first key, and for the PDU session that does not correspond to the first key (also (That is, the downlink user plane data received from the user plane function entity other than the PDU session corresponding to the first key) does not need to undergo the second security protection process, but is processed in accordance with related technologies.

In the above exemplary embodiment, only the user plane data transmitted with the core network through a partial PDU session is secured, rather than all the user plane data of the UE is secured, thereby improving the user plane data that does not need to be performed. Processing efficiency reduces business delay.

(1) In the case that the security protection only includes confidentiality protection, the first key only includes the encryption key. Correspondingly, using the first key to perform the first security protection processing on the uplink target user plane data includes: using the encryption key to encrypt the uplink target user plane data. Using the first key to perform the second security protection process on the downlink target user data after the first security protection process includes: using an encryption key to decrypt the encrypted downlink target user data.

(2) In the case that the security protection only includes integrity protection, the first key only includes the integrity key. Correspondingly, using the first key to perform the first security protection processing on the uplink target user plane data includes: using the integrity key to perform the integrity protection processing on the uplink target user plane data. Using the first key to perform the second security protection processing on the downlink target user plane data after the first security protection process includes: using the integrity key to perform integrity verification on the downlink target user plane data after the integrity protection process.

(3) In the case that security protection includes both confidentiality protection and integrity protection, the first key includes an encryption key and an integrity key. Correspondingly, using the first key to perform the first security protection processing on the uplink target user plane data includes: using the encryption key to encrypt the uplink target user plane data, and using the integrity key to perform the encrypted uplink target user plane data. Integrity protection processing. Using the first key to perform the second security protection process on the downlink target user plane data after the first security protection process includes: using the integrity key to perform integrity verification on the downlink target user plane data after the encryption and integrity protection process. After passing the verification, use the encryption key to decrypt the encrypted downlink target user data.

In an implementation manner, the control plane functional entity and the user plane functional entity are different devices set in the core network.

In an implementable manner, the control plane functional entity is a control plane network functional entity responsible for user equipment access and service processing.

In an implementation manner, the user plane functional entity is a forwarding plane network functional entity that processes user application data.

In an implementable manner, in a 5G network, the control plane functional entity is an Access Management Function (AMF) entity, and the user plane functional entity is a UPF entity.

In another possible implementation manner, in an evolved packet core network (EPC), the control plane functional entity is a mobility management entity (Mobility Management Entity, MME), and the user plane functional entity is a service gateway ( Serving GateWay, SGW) or Packet GateWay (PGW).

The following specific examples are used to describe the specific implementation process of the foregoing embodiments in detail. It should be noted that the examples listed are only for convenience of description and cannot be used to limit the protection scope of the embodiments of the present disclosure.

Example 1

If a virtual network operator provides network services and it leases access equipment, the access equipment is not trustworthy for the application, and an encrypted channel needs to be established directly between the UE and the core network equipment; or in the following scenario, multiple core network operators Shared access network functional entities, in order to ensure data security, it is also necessary to establish an encrypted channel between the UE and each core network. For the above scenario, the key required for encryption and integrity protection of user plane data can be generated during the registration and authentication phase of the UE accessing the core network, so that the user plane data can be encrypted for transmission and integrity protection when the UE conducts services. Taking the 5G network as an example, the implementation process is described in Figure 6. The control plane functional entity in the solution is an AMF entity, and the user plane functional entity is a UPF entity.

1. The UE requests to access the 5G network and initiates a registration authentication request to the AMF entity. The RAN functional entity routes the registration authentication request to the AMF entity according to the hidden subscription identifier (SUCI) in the registration authentication request.

2. The authentication process is completed between UE, AMF entity, Authentication Server Function (AUSF) entity and Unified Data Management (UDM) entity. For other registration procedures among UE, RAN entities, and AMF entities, please refer to 3GPP TS 23.502 registration and authentication procedures for details.

3. After the authentication process is completed, the AMF entity generates the anchor key K _SEAF , and the AMF uses the key generation algorithm to derive the key _{according to K SEAF} _{, and finally generates the second key K gNB} . If AMF decides that user plane data needs to be secured between the UE and the user plane functional entity (for example, the operator policy or user subscription information stipulates that the user plane data needs to be secured between the UE and the user plane functional entity , The AMF entity decides that the user plane data needs to be secured between the UE and the user plane function entity according to the operator's policy or user subscription information), then proceed to step 4.

4. The AMF entity sends a notification message to the RAN functional entity and the UE through the N1 message and/or the N2 message.

5. Complete the remaining registration procedures between the UE and the RAN functional entity and the AMF entity, and establish a NAS security channel between the UE and the AMF entity.

6. The UE generates a first key according to a hierarchical key derivation algorithm according to the root key. The first key includes an encryption key K _UPenc and an integrity key K _UPint .

7. The UE sends the encryption key K _UPenc and the integrity key K _UPint to the AMF entity through the NAS secure channel, and the AMF entity sends the encryption key K _UPenc and the integrity key K _UPint to the UPF entity. Among them, the AMF entity may send the encryption key K _UPenc and the integrity key K _UPint to the UPF entity through the SMF entity in the PDU session establishment phase.

8. The UPF entity saves the encryption key K _UPenc and the integrity key K _UPint .

9. Confidentiality and integrity protection of the user plane data between the UE and the UPF entity, the related process can refer to the description of Example 3.

According to related technologies, the encryption key K _UPenc and the integrity key K _UPint are generated by the RAN entity. Step 7 in the above solution can also be replaced by the following solution. The RAN entity provides the encryption key K _UPenc and the integrity key K _UPint to the AMF entity through the N2 interface message. The AMF entity is further provided to the UPF entity.

The above solution describes that after the UE is registered on the 5G network, the user plane data is secured between the UE and the 5G core network, that is, all user plane data interacted between the UE and the 5G core network are protected for confidentiality and integrity. The above solution is also applicable to EPC. The control plane functional entity of the solution is MME, and the user plane functional entity is SGW or PGW.

Example 2

Example 1 describes the security protection of user plane data between the UE and the 5G core network. The 5G network can also provide network services in the form of network slicing, that is, 5GC can include multiple network slices. After the UE is registered on the 5G network, it can access up to 8 network slices. Example 2 describes the provision of security protection for user plane data between the UE and the core network at the network slicing level, and the implementation process is shown in FIG. 7. In the solution, the network control function entity is an AMF entity, and the user plane function entity is a UPF entity.

1. After the UE has successfully registered to the 5G network, the UE requests the access network functional entity network slice, and initiates a PDU session establishment request. The PDU session establishment request includes a NAS message. The NAS message includes: single network slice selection auxiliary information (Single Network) Slice Selection Assistance Information, S-NSSAI), etc. The S-NSSAI contains the network slice identifier that authorizes the UE to request access. AMF saves S-NSSAI and other information.

2. After receiving the PDU session establishment request, the AMF entity obtains the user's subscription information. The subscription information contains the user's authorized S-NSSAI. The network slice corresponding to each S-NSSAI is used for the type of service carried, and whether it needs to be in the UE and Information such as security protection of user plane data between user plane functional entities. If the user's subscription information is not saved on the AMF entity, the user's subscription information is obtained from the UDM entity.

3. The AMF entity combines the user's subscription information and decides to implement the PDU session to securely protect the user plane data between the UE and the user plane functional entity.

4. The AMF entity selects the SMF entity based on information such as S-NSSAI.

5. The AMF entity initiates a PDU session context creation request to the SMF entity, and the PDU session context creation request includes information such as a subscriber permanent identifier (Subscription Permanent Identifier, SUPI), a second key K _gNB, and so on.

6. The SMF entity returns a PDU session context creation response to the AMF entity.

7. If the PDU session establishment request in step 1 is sent for the first time, the SMF entity performs UPF entity selection; if the PDU session establishment request in step 1 is not sent for the first time, step 9 is directly executed.

8. The SMF entity initiates an N4 session establishment request to the selected UPF entity, and provides information such as _{flow detection rules and the second key K gNB corresponding to the PDU session.} An N4 session is established between the SMF entity and the UPF entity.

9. The UPF entity saves the second key K _gNB .

10. The AMF entity and the RAN entity exchange messages on the N2 interface and send a notification message to the RAN entity.

11. The RAN entity stores information indicating whether the user plane data needs to be secured between the UE and the user plane functional entity.

12. The UE, RAN functional entity, AMF entity, SMF entity, and UPF entity complete the rest of the PDU session establishment process.

13. The AMF entity returns a PDU session establishment response to the UE.

14. The UE uses the key hierarchy derivation algorithm to derive the first key according to the root key. The first key includes: an encryption key K _UPenc and an integrity key K _UPint . _{The UPF entity derives the} first key according to the second key K gNB according to the same key generation algorithm. The first key includes: an encryption key K _UPenc and an integrity key K _UPint .

15. Refer to Example 3 for the process of confidentiality and integrity protection of user plane data between the UE and the UPF entity.

Example 3

According to whether the AMF entity sends a notification message to the RAN functional entity in the foregoing example 1 or example 2, the RAN functional entity determines whether the user plane data transmitted between the UE and the UPF entity needs to be encrypted, decrypted and integrity protected.

For the uplink user plane data, the UE completes the encapsulation of the sent uplink user plane data according to the UE protocol stack shown in FIG. 8 or FIG. 9, and sends the encapsulated uplink user plane data. Specifically, the application layer encapsulation is performed on the uplink user plane data, the PDU layer encapsulation is performed on the uplink user plane data after the application layer encapsulation, and the simple distributed file transfer system access protocol is performed on the uplink user plane data after the PDU layer encapsulation. File System Access Protocol, SDAP) encapsulation, use K _UPenc to encrypt the uplink user plane data after SDAP encapsulation, use K _UPint to perform integrity protection processing on the encrypted uplink user plane data, and perform integrity protection on the upstream users after integrity protection processing The plane data is encapsulated in PDCP, the PDCP encapsulated uplink user plane data is encapsulated by the radio link control layer (Radio Link Control, RLC), and the RLC encapsulated uplink user plane data is encapsulated in Media Access Control (MAC). Layer encapsulation: Physical layer (PHY) encapsulation is performed on the uplink user plane data after MAC layer encapsulation.

When the PHY-encapsulated uplink user plane data is sent to the RAN functional entity, the RAN functional entity determines whether the PHY-encapsulated uplink user plane data belongs to the data exchanged between the UE and the UPF entity; if the PHY-encapsulated uplink user plane data belongs to For the data exchanged between the UE and the UPF entity, the RAN functional entity does not perform encryption, decryption, integrity protection and integrity verification on the PHY-encapsulated uplink user plane data. It only completes the protocol conversion shown in Figure 9. First, the PHY The encapsulated uplink user plane data is PHY decapsulated, the PHY decapsulated uplink user plane data is decapsulated at the MAC layer, the MAC layer decapsulated uplink user plane data is decapsulated with RLC, and then the RLC is decapsulated The uplink user plane data is converted into a general packet radio service tunneling protocol (General Packet Radio Service (GPRS) Tunnelling Protocol, GTP,) encapsulation format. During the protocol conversion process, the RAN functional entity does not perform any processing on the PDCP layer and above, that is, does not perform decryption and integrity verification processing on the uplink user plane data. After the RAN functional entity completes the protocol conversion processing on the uplink user plane data, it is sent to the UPF entity.

The UPF entity receives the upstream user plane data after protocol conversion, decapsulates the upstream user plane data after protocol conversion at the L1 layer, decapsulates the upstream user plane data after decapsulation at the L1 layer, and decapsulates the L2 layer after decapsulation. GTP-U/UDP (User Datagram Protocol, User Datagram Protocol)/IP (Internet Protocol, Internet Protocol) layer decapsulation of upstream user plane data, and decapsulation of GTP-U/UDP/IP layer upstream The user plane is decapsulated by PDCP, and K _{UPint is} used to verify the integrity of the uplink user plane data after PDCP decapsulation. After the verification is passed, use K _UPenc to decrypt the uplink user plane data after PDCP decapsulation. SDAP decapsulation is performed on the uplink user plane data, and the PDU layer decapsulation is performed on the uplink user plane data after SDAP decapsulation.

If the PHY-encapsulated uplink user plane data does not belong to the data exchanged between the UE and the UPF entity, the RAN functional entity first performs the PHY-encapsulated uplink user plane data according to the protocol stack part of the RAN functional entity shown in Figure 9. PHY decapsulation, MAC layer decapsulation of the uplink user plane data after PHY decapsulation, RLC decapsulation of the uplink user plane data after MAC layer decapsulation, and PDCP decapsulation of the uplink user plane data after RLC decapsulation _{, Use K UPint to} perform integrity verification on the uplink user plane data after PDCP decapsulation, _{use K UPenc} for decryption after the verification is passed, and then convert the decrypted uplink user plane data into a GTP encapsulation format. During the protocol conversion process, the RAN functional entity does not do any processing on the SDAP layer and above. After the RAN functional entity completes the protocol conversion processing on the uplink user plane data, it sends it to the UPF entity.

For the downlink user plane data, the UPF entity completes the encapsulation of the sent downlink user plane data according to the UPF protocol stack part shown in FIG. 8, and sends the encapsulated downlink user plane data. Specifically, perform application layer encapsulation on the downlink user plane data, perform PDU layer encapsulation on the downlink user plane data after the application layer encapsulation, perform SDAP encapsulation on the downlink user plane data after PDU layer encapsulation, and use K _UPenc to encapsulate the SDAP Encrypt the downlink user plane data, use K _UPint to perform integrity protection processing on the encrypted downlink user plane data, perform PDCP encapsulation on the downlink user plane data after integrity protection processing, and perform GTP on the PDCP encapsulated downlink user plane data -U/UDP/IP encapsulation, L2 layer encapsulation is performed on the downlink user plane data after GTP-U/UDP/IP encapsulation, and the L1 layer encapsulation is performed on the downlink user plane data after the L2 layer encapsulation.

Or, the UPF entity completes the encapsulation of the sent downlink user plane data according to the UPF protocol stack part shown in FIG. 10, and sends the encapsulated downlink user plane data. Specifically, the application layer encapsulation is performed on the downlink user plane data, the PDU layer encapsulation is performed on the downlink user plane data after the application layer encapsulation, the downlink user plane data after the PDU layer encapsulation is SDAP encapsulated, and the downlink user plane after the SDAP encapsulation is performed Data is GTP-U encapsulated, GTP-U encapsulated downlink user plane data is UDP/IP encapsulated, UDP/IP encapsulated downlink user plane data is L2 layer encapsulated, and L2 layer encapsulated downlink user plane data is encapsulated Carry out L1 layer encapsulation.

When the downlink user plane data encapsulated by the L1 layer is sent to the RAN functional entity, the RAN functional entity judges whether the downlink user plane data encapsulated by the L1 layer belongs to the data exchanged between the UE and the UPF; if the downlink user plane data encapsulated by the L1 layer is If the data belongs to the data exchanged between the UE and the UPF, the RAN functional entity does not perform encryption, decryption, integrity protection, and integrity verification on the downlink user plane data encapsulated at the L1 layer, and only completes the protocol conversion shown in Figure 9. First, Decapsulate the downlink user plane data after L1 layer encapsulation, decapsulate the downlink user plane data after L1 layer decapsulation, decapsulate the downlink user plane data after L1 layer decapsulation, and perform GTP-U/UDP on the downlink user plane data decapsulated at the L2 layer /IP decapsulation, and then convert the downlink user plane data after GTP-U/UDP/IP decapsulation into RLC encapsulation format. In the protocol conversion process, the RAN functional entity does not perform any processing on the PDCP layer and above, that is, does not perform decryption and integrity verification processing on the downlink user plane data. After the RAN functional entity completes the protocol conversion processing on the downlink user plane data, it sends it to the UPF.

The UE receives the downlink user plane data after protocol conversion, decapsulates the downlink user plane data after protocol conversion, decapsulates the downlink user plane data after PHY decapsulation, and decapsulates the downlink user plane data after the MAC layer decapsulation. The plane data is decapsulated at the RLC layer, and the downlink user plane decapsulated at the RLC layer is decapsulated with PDCP. K _{UPint is} used to verify the integrity of the downlink user plane data after the PDCP decapsulation. After the verification is passed, use K _UPenc Decrypt the downlink user plane data after PDCP decapsulation, perform SDAP decapsulation on the decrypted downlink user plane data, and perform PDU layer decapsulation on the downlink user plane data after SDAP decapsulation.

If the downlink user plane data encapsulated by the L1 layer does not belong to the data exchanged between the UE and the UPF entity, the RAN functional entity first encapsulates the downlink user plane after the L1 layer is encapsulated according to the protocol stack part of the RAN functional entity shown in Figure 10 The data is decapsulated at the L1 layer, the downlink user plane data after the decapsulation of the L1 layer is decapsulated at the L2 layer, the downlink user plane data after the decapsulation of the L2 layer is decapsulated by UDP/IP, and the UDP/IP is decapsulated. The downlink user plane data is decapsulated by GTP-U, and the downlink user plane data after the GTP-U decapsulation is converted into an RLC encapsulation format. During the protocol conversion process, the RAN functional entity does not do any processing on the SDAP layer and above. After the RAN functional entity completes the protocol conversion processing on the downlink user plane data, it is sent to the UE.

The embodiment of the present disclosure further provides an electronic device, including: at least one processor; and, a memory, on which at least one program is stored. When the at least one program is executed by the at least one processor, the at least one processor implements the implementation of the present disclosure. The example provides at least one step of the data transmission method.

A processor is a device with data processing capabilities, including but not limited to a central processing unit (CPU), etc.; a memory is a device with data storage capabilities, including but not limited to random access memory (Random Access Memory, RAM, more specifically, such as Synchronous Dynamic Random-access Memory (SDRAM), Data Direction Register (DDR), etc.), Read-Only Memory (ROM), Erasable when charged Programmable read-only memory (Electrically Erasable Programmable Read Only Memory, EEPROM), flash memory (FLASH).

In an implementation manner, the processor and the memory are connected to each other through a bus, and further connected to other components of the electronic device.

The embodiment of the present disclosure also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, at least one step of the data transmission method provided in the embodiment of the present disclosure is implemented.

The embodiment of the present disclosure also provides a data transmission device, which can be applied to a control plane functional entity, or can be specifically a control plane functional entity. 10, which is a block diagram of a data transmission device according to an embodiment of the present disclosure. The data transmission device may include: a first determining module 1001 and a first notification message sending module 1002.

The first determining module 1001 is configured to determine target user plane data that needs to be secured between the target user equipment and the user plane functional entity.

The first notification message sending module 1002 is configured to send a notification message to the access network function entity and the target user equipment. The notification message is used to instruct the target user plane data to be securely protected between the target user equipment and the user plane function entity.

In an implementable manner, the data transmission apparatus may further include: a key forwarding module 1003, configured to receive the first key returned by the target user equipment or the access network function entity, and send the first key to the user plane function entity. Key: The first key is used by the user plane functional entity and the target user equipment to securely protect the target user plane data between the target user equipment and the user plane functional entity.

In a possible implementation, the first key may include a confidentiality key and/or an integrity key.

In an implementation manner, the data transmission device may further include: a first key sending module 1004 configured to generate a second key and send the second key to the user plane function entity; the second key is used for Used by the user plane functional entity to generate the first key.

The specific implementation process of the aforementioned data transmission device is the same as the specific implementation process of the aforementioned data transmission method on the functional entity side of the control plane, and will not be repeated here.

The embodiments of the present disclosure also provide another data transmission device, which can be applied to an access network functional entity, or can be specifically an access network functional entity. Referring to FIG. 11, which is a block diagram of a data transmission device provided by an embodiment of the present disclosure, the data transmission device may include: a first notification message receiving module 1101.

The first notification message receiving module 1101 is configured to receive a notification message sent by the control plane functional entity, where the notification message is used to instruct the target user plane data to be securely protected between the target user equipment and the user plane functional entity.

In an implementable manner, the data transmission apparatus may further include: a second key sending module 1102, configured to send the first key to the control plane functional entity; wherein, the first key is in the target user equipment and the user The key used to securely protect the target user plane data between plane functional entities.

In an implementable manner, the data transmission device may further include: a first data processing module 1103 configured to determine, according to the notification message, whether the user plane data received by the access network functional entity is target user plane data; The target user plane data is not processed for security protection, and is forwarded after protocol conversion.

The specific implementation process of the aforementioned data transmission device is the same as the specific implementation process of the aforementioned data transmission method on the access network functional entity side, and will not be repeated here.

The embodiments of the present disclosure also provide another data transmission device, which can be applied to a user plane functional entity, or can be specifically a user plane functional entity. 12, which is a block diagram of a data transmission device provided by an embodiment of the present disclosure. The data transmission device may include: a key acquisition module 1201 and a second data processing module 1202.

The key acquisition module 1201 is configured to receive the first key sent by the control plane functional entity; or, receive the second key sent by the control plane functional entity, and generate the first key according to the second key.

The second data processing module 1202 is configured to use the first key to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity.

In an implementation manner, the second data processing module 1202 is specifically configured to: use a confidentiality key to encrypt the target user plane data sent to the target user equipment; use the confidentiality key to encrypt data received from the target user equipment The target user plane data is decrypted.

In another implementable manner, the second data processing module 1202 is specifically configured to: use the integrity key to perform integrity protection on the target user plane data sent to the target user equipment; use the integrity key to perform integrity protection on the target user plane data received from the target The integrity of the target user plane data of the user equipment is checked.

In another possible implementation manner, the second data processing module 1202 is specifically configured to use a confidentiality key to encrypt the target user plane data sent to the target user equipment, and use the integrity key to perform the target user plane data on the target user plane data. Integrity protection.

In another possible implementation manner, the second data processing module 1202 is specifically configured to use the integrity key to perform integrity verification on the target user plane data received from the target user equipment, and use the confidentiality secret after the verification is passed. The key decrypts the target user plane data.

The specific implementation process of the above-mentioned data transmission device is the same as the specific implementation process of the aforementioned data transmission method on the entity side of the user plane function, and will not be repeated here.

The embodiments of the present disclosure also provide another data transmission device, which can be applied to a target UE or can be specifically a target UE. 13, which is a block diagram of a data transmission device provided by an embodiment of the present disclosure. The data transmission device may include a second notification message receiving module 1301.

The second notification message receiving module 1301 is configured to receive a notification message sent by the control plane functional entity, where the notification message is used to instruct the target user plane data to be securely protected between the target user equipment and the user plane functional entity.

In an implementation manner, the data transmission device may further include: a third key sending module 1302 configured to generate a first key and send the first key to the control panel functional entity; the first key includes Confidentiality key and/or integrity key.

In an implementable manner, the data transmission device may further include: a third data processing module 1303 configured to use a confidentiality key to encrypt target user plane data sent to a user plane functional entity; and use a confidentiality key Decrypt the target user plane data received from the user functional entity.

In another possible implementation manner, the third data processing module 1303 may also be configured to use the integrity key to perform integrity protection processing on the target user plane data sent to the user plane functional entity; use the integrity key pair The integrity check is performed on the target user plane data received from the user functional entity.

In another possible implementation manner, the third data processing module 1303 may also be configured to use a confidentiality key to encrypt target user plane data sent to the user plane functional entity, and use an integrity key to encrypt the encrypted target user plane data. The target user plane data is processed for integrity protection.

In another possible implementation manner, the third data processing module 1303 may also be configured to use the integrity key to perform integrity verification on the target user plane data received from the user functional entity, and use confidentiality after the verification is passed. The key decrypts the target user plane data.

The specific implementation process of the foregoing data transmission device is the same as the specific implementation process of the foregoing target UE side data transmission method, and will not be repeated here.

The embodiment of the present disclosure also provides a data transmission system. 14, which is a block diagram of a data transmission system provided by an embodiment of the present disclosure. The data transmission system may include: a control plane function entity 1401, an access network function entity 1402, and a target user equipment 1403.

The control plane function entity 1401 is configured to determine target user plane data that needs to be secured between the target user equipment 1403 and the user plane function entity 1404; and, send notification messages to the access network function entity 1402 and the target user equipment 1403 . The notification message is used to indicate that the target user plane data is securely protected between the target user equipment 1403 and the user plane function entity 1404.

The access network function entity 1402 is configured to receive notification messages sent by the control plane function entity 1401.

The target user equipment 1403 is configured to receive the notification message sent by the control plane functional entity 1401.

In an implementable manner, the control plane function entity 1401 is further configured to: receive the first key returned by the target user equipment 1403 or the access network function entity 1402, and send the first key to the user plane function entity 1404; The first key is used by the user plane function entity 1404 and the target user equipment 1403 to securely protect the target user plane data between the target user equipment 1403 and the user plane function entity 1404.

The target user equipment 1403 is further configured to generate a first key and send the first key to the control panel functional entity; the first key includes a confidentiality key and/or an integrity key.

The access network function entity 1402 is further configured to send the first key to the control panel function entity.

In an implementation manner, the control plane function entity 1401 is further configured to: generate a second key and send the second key to the user plane function entity 1404; the second key is used by the user plane function entity 1404 , Generate the first key.

The data transmission system may further include: a user plane function entity 1404 configured to receive a second key sent by the control plane function entity 1401, and generate a first key according to the second key.

In an implementable manner, the target UE 1403 is further configured to: use the first key to securely protect the target user plane data transmitted between the target user equipment 1403 and the user plane functional entity 1404.

The user plane function entity 1404 is further configured to: use the first key to securely protect the target user plane data transmitted between the target user equipment 1403 and the user plane function entity 1404.

The specific implementation process of the foregoing data transmission system is the same as the specific implementation process of the foregoing data transmission method, and will not be repeated here.

A person of ordinary skill in the art can understand that all or some of the steps, functional modules/units in the system, and apparatus in the methods disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. In the hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may consist of several physical components. The components are executed cooperatively. Certain physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit . Such software may be distributed on a computer-readable medium, and the computer-readable medium may include a computer storage medium (or a non-transitory medium) and a communication medium (or a transitory medium). As is well known by those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile implementations in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Sexual, removable and non-removable media. Computer storage media include but are not limited to RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or Any other medium used to store desired information and that can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that a communication medium usually contains computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium. .

Example embodiments have been disclosed herein, and although specific terms are adopted, they are used and should only be interpreted as general descriptive meanings, and are not used for the purpose of limitation. In some instances, it is obvious to those skilled in the art that, unless expressly indicated otherwise, the features, characteristics, and/or elements described in combination with a specific embodiment can be used alone, or features described in combination with other embodiments, Combination of features and/or components. Therefore, those skilled in the art will understand that various changes in form and details can be made without departing from the scope of the present disclosure as set forth by the appended claims.

Claims

A data transmission method applied to control plane functional entities, including:

Determine the target user plane data that needs to be secured between the target user equipment and the user plane functional entity; and

Send a notification message to the access network functional entity and the target user equipment; wherein the notification message is used to indicate that the target user plane data is securely protected between the target user equipment and the user plane functional entity .
The method according to claim 1, further comprising:

Receiving the first key returned by the target user equipment or the access network functional entity, and sending the first key to the user plane functional entity;

Wherein, the first key is used by the user plane functional entity and the target user equipment to securely protect the target user plane data between the target user equipment and the user plane functional entity .
The method according to claim 2, wherein the first key includes a confidentiality key and/or an integrity key.
The method according to claim 1, further comprising:

Generate a second key, and send the second key to the user plane functional entity;

Wherein, the second key is used by the user plane functional entity to generate the first key.
A data transmission method applied to access network functional entities, including:

Receive notification messages sent by the control plane functional entity;

Wherein, the notification message is used to indicate that the target user plane data is securely protected between the target user equipment and the user plane functional entity.
The method according to claim 5, further comprising:

Determining, according to the notification message, that the user plane data received by the access network functional entity is the target user plane data; and

No security protection processing is performed on the target user plane data, and protocol conversion and forwarding are performed on the target user plane data.
A data transmission method applied to user plane functional entities, including:

Receiving the first key sent by the control plane functional entity; or receiving the second key sent by the control plane functional entity, and generating the first key according to the second key; and

The first key is used to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity.
The method according to claim 7, wherein the first key includes a confidentiality key and/or an integrity key; and

Using the first key to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity includes:

Use the confidentiality key to encrypt the first target user plane data sent to the target user equipment; and use the confidentiality key to encrypt the second target user plane data received from the target user equipment Decrypt; or

Use the integrity key to perform integrity protection on the first target user plane data sent to the target user equipment; and, use the integrity key to perform integrity protection on the second target user plane data received from the target user equipment. Data integrity check; or

Use the confidentiality key to encrypt the first target user plane data sent to the target user equipment, and use the integrity key to perform integrity protection on the first target user plane data; or

Use the integrity key to perform integrity verification on the second target user plane data received from the target user equipment, and use the confidentiality key to perform integrity verification on the second target user plane data after the verification is passed. Decrypted.
A data transmission method applied to target user equipment, including:

Receive notification messages sent by the control plane functional entity;

Wherein, the notification message is used to indicate that the target user plane data is securely protected between the target user equipment and the user plane function entity.
The method according to claim 9, further comprising:

Generate a first key, and send the first key to the control panel functional entity;

Wherein, the first key includes a confidentiality key and/or an integrity key.
The method according to claim 10, further comprising:

Use the confidentiality key to encrypt the second target user plane data sent to the user function entity; and use the confidentiality key to decrypt the first target user plane data received from the user function entity ;or

Use the integrity key to perform integrity protection processing on the second target user plane data sent to the user function entity; and use the integrity key to perform integrity protection on the first target user plane received from the user function entity Data integrity check; or

Use the confidentiality key to encrypt the second target user plane data sent to the user plane functional entity, and use the integrity key to perform integrity protection on the encrypted second target user plane data Processing; or

The integrity key is used to perform integrity verification on the first target user plane data received from the user functional entity, and after the verification is passed, the confidentiality key is used to decrypt the first target user plane data.
An electronic device including:

At least one processor; and

A storage device having at least one program stored thereon, and when the at least one program is executed by the at least one processor, the at least one processor realizes the data transmission method according to any one of claims 1-11.
A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data transmission method according to any one of claims 1-11.
A data transmission system includes:

The control plane functional entity is configured to determine target user plane data that needs to be secured between the target user equipment and the user plane functional entity; and, send a notification message to the access network functional entity and the target user equipment; wherein, The notification message is used to instruct to perform security protection on the target user plane data between the target user equipment and the user plane functional entity;

The access network functional entity is configured to receive notification messages sent by the control plane functional entity; and

The target user equipment is configured to receive a notification message sent by a control plane functional entity.